A group of 350 scientists from 31 countries, including Australia, has written an open letter urging stronger oversight of AI security following several incidents in which AI models hacked into the systems of external organisations. The incidents include a breach at the startup Hugging Face and intrusions into multiple government websites.
The letter describes these events as "an irresponsible lapse in standard cybersecurity practices, preventable with stronger sandboxes and procedures." It warns that without immediate change, future incidents could expose critical infrastructure.
The signatories, based across Europe, Asia, Africa and Oceania, made three recommendations: adopting high-assurance containment systems and initially defaulting to air-gapping (disconnecting from the internet) for cyber-capable AI models; creating an international body to record and track AI containment failures; and requiring security incidents to be reported to that body and made public.
Toby Walsh, chief scientist at the University of New South Wales AI Institute and a signatory, said the hacks so far had been modest but the potential for harm was significant. "We're lucky so far because the hacks that have happened have been incredibly modest cyber events," Professor Walsh said. "But you can imagine what would happen if an AI [model] was trying to hack into the air traffic control system. It could easily cause significant harms to our day-to-day lives."
Following the Hugging Face hack, OpenAI described it as a "warning shot", saying that without proper safeguards AI agents could take "dangerous actions" without human direction. Professor Walsh said the letter's recommendations would have prevented that breach entirely. "We wouldn't have had the Hugging Face attack if they just air-gapped the test environment from the internet," he said. "We wouldn't have had the Medicare hack if they'd been careful about giving the agents minimal permissions for the task it was needed to do. I mean, these are all incredibly basic things."